Brute Force Attack.

What Is a Brute Force Attack?

A brute force attack is a method of guessing passwords or other secret values by trying many combinations until one works. MITRE ATT&CK describes the Brute Force technique (T1110) as adversaries gaining access to accounts when passwords are unknown or when password hashes are obtained. They do it by systematically guessing the password with a repetitive or iterative mechanism. NIST defines a brute force password attack as a method of accessing an obstructed device by attempting multiple combinations of numeric or alphanumeric passwords.

How Does a Brute Force Attack Work?

OWASP explains that the attacker uses predetermined values, makes requests to a server with those values, and then analyses the responses. The attacker can use a dictionary, which is a list of likely values, or can try combinations of different character classes.

MITRE says this activity can happen online, through service validation, or offline, against credential data the adversary has already obtained. It also says brute forcing can happen at various points during a breach, including after a compromise, using data from credential dumping or account discovery, and at initial access.

MITRE also notes a workaround. If the attacker guesses the right password but a location-based conditional access policy blocks the login, they may change their infrastructure until it matches the victim’s location.

Which Four Kinds of Brute Force Does MITRE List?

MITRE ATT&CK lists four sub-techniques under Brute Force. They differ in what the attacker already holds and where the guessing happens.

MITRE says the hashes for cracking can come from OS credential dumping. Kerberoasting is one known case, where service ticket hashes are attacked offline. Two sub-techniques have their own pages: password spraying and credential stuffing.

MITRE says the technique is used when passwords are unknown or when password hashes have been obtained. A password hash is a scrambled form of a password that a system stores instead of the password itself.

What Does an Unlimited Login Page Invite?

Picture a login page that has no limit on failed attempts. An attacker feeds it a list of common usernames and passwords until one pair is accepted. OWASP describes this case: brute force attacks are often mounted when no account lockout policy is in place, and when no password policy exists, attackers use lists of common usernames and passwords to brute force a field until authentication succeeds.

A lockout only helps if every route to the login counts. In pgAdmin 4 before 9.19, CVE-2026-116238 let attackers skip the failed login limit through a second login view, as our pgAdmin 9.19 lockout fix and upgrade steps explain.

OWASP also shows the same idea used to find hidden resources. A tool requests known page names from a word list and reads the response codes to see which pages exist.

How Can You Reduce the Risk of Brute Force Attacks?

The sources suggest these steps.

• MITRE recommends account lockout after failed login attempts, and conditional access restrictions.
• MITRE recommends multi-factor authentication, especially on externally facing services. This means asking for a second proof of identity besides the password.
• MITRE recommends following NIST guidelines when creating password policies.
• MITRE recommends resetting accounts that are known to be breached or that show signs of brute forcing.
• OWASP recommends account lockout after failed login attempts and tools that detect the scanning patterns typical of brute force tools. It also notes that attackers can get false positives when a server returns HTTP 200 but shows a “File not found” message.

Why Does MFA Matter After a Correct Guess?

Related terms are credential theft and multi-factor authentication. MITRE lists multi-factor authentication as a mitigation for brute force. A guess that works gives the attacker a valid account, which is why MFA matters here.

Is a Brute Force Attack the Same as a Dictionary Attack?

Not exactly. OWASP treats dictionary attacks and traditional brute force with character classes as two ways to carry out a brute force attack. The dictionary approach uses a list of likely values. The traditional approach tries combinations of characters.

Does a Brute Force Attack Target Passwords Alone?

No. MITRE focuses on password guessing for account access. OWASP also describes using the same method to discover resources on a server, such as directories.

Where Does Brandefense Fit?

Brandefense offers dark web monitoring. For credential stuffing, leaked credential monitoring shows which logins are already exposed.